CVE-2013-2131
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows...
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.
Exploit likelihood
What each source reports
NVD Score used
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.
- Record
CVE-2013-2131- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-134
- Updated
- 2026-11-02
CVE List No score
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.
- Record
CVE-2013-2131- Updated
- 2026-11-02
EUVDEUVD-2013-2099 No score
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.
- Record
EUVD-2013-2099- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fw9w-xf98-wvqv No score
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows...
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.
- Record
GHSA-fw9w-xf98-wvqv- Weakness
- CWE-134
- Updated
- 2026-11-02
OSV No score
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.
- Record
CVE-2013-2131- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-2131 No score
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.
- Record
DEBIAN-CVE-2013-2131- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10163-1 No score
lua-rrdtool-1.6.0-1.1 on GA media
These are all security issues fixed in the lua-rrdtool-1.6.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10163-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:0103-1 No score
Security update for rrdtool
This update for rrdtool provides the following fixes:
- CVE-2013-2131: Enhance imginfo format validation checks to prevent crashes. (bsc#828003)
- Add rrdtool-cached sub-package to SLE 12-SP1. (bsc#967671)
- Record
SUSE-SU-2017:0103-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-2131 No score
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.
- Record
UBUNTU-CVE-2013-2131- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rrdtoolDebian:12 |
before 1.4.8-1 | 1.4.8-1 |
rrdtoolDebian:13 |
before 1.4.8-1 | 1.4.8-1 |
rrdtoolDebian:14 |
before 1.4.8-1 | 1.4.8-1 |
rrdtoolSUSE:Linux Enterprise Desktop 12 SP1 |
before 1.4.7-20.1 | 1.4.7-20.1 |
rrdtoolSUSE:Linux Enterprise Desktop 12 SP2 |
before 1.4.7-20.1 | 1.4.7-20.1 |
rrdtoolSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 1.4.7-20.1 | 1.4.7-20.1 |
rrdtoolSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 1.4.7-20.1 | 1.4.7-20.1 |
rrdtoolSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 1.4.7-20.1 | 1.4.7-20.1 |
rrdtoolSUSE:Linux Enterprise Server 12 SP1 |
before 1.4.7-20.1 | 1.4.7-20.1 |
rrdtoolSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 1.4.7-20.1 | 1.4.7-20.1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rrdtoolSUSE:Linux Enterprise Server 12 SP2 |
before 1.4.7-20.1 | 1.4.7-20.1 |
rrdtoolSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 1.4.7-20.1 | 1.4.7-20.1 |
rrdtoolUbuntu:14.04:LTS |
All versions, plus listed versions 1.4.7-2ubuntu21.4.7-2ubuntu31.4.7-2ubuntu41.4.7-2ubuntu5 |
None known |
rrdtoolUbuntu:18.04:LTS |
before 1.7.0-1build1, plus listed versions 1.6.0-1ubuntu21.7.0-0ubuntu41.7.0-1 |
1.7.0-1build1 |
rrdtoolUbuntu:20.04:LTS |
before 1.7.2-3build1, plus listed versions 1.7.1-21.7.2-1ubuntu21.7.2-3 |
1.7.2-3build1 |
rrdtoolUbuntu:22.04:LTS |
before 1.7.2-3ubuntu5, plus listed versions 1.7.2-3build61.7.2-3ubuntu11.7.2-3ubuntu2 |
1.7.2-3ubuntu5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Python RRDtool Module - Function Format String | 2013-05-18 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2131 is a medium vulnerability (CVSS 5.0) in Rrdtool Project Rrdtool, published January 4, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.6%, the 95th percentile. Fixed in rrdtool 1.4.8-1.
References
openwall.com/lists/oss-security/2013/04/18/5
bugzilla.redhat.com/show_bug.cgi?id=969296
github.com/oetiker/rrdtool-1.x/pull/397
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-2131
security-tracker.debian.org/tracker/CVE-2013-2131
suse.com/support/update/announcement/2017/suse-su-20170103-1
bugzilla.suse.com/828003
ubuntu.com/security/CVE-2013-2131
cve.org/CVERecord?id=CVE-2013-2131